Re: com php-src: fixed leak introduced after CVE/upgrade: ext/fileinfo/libmagic/softmagic.c

Hi all, According to NVD, it is affected 5.0 and up. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1943 and it seems 5.3's libmagic seems to be 5.11 commit 12cf930a403d0bbee0c40a5e93554cafd6b0895e Author: Pierre Joye <pierre.php@gmail.com> Date: Tue Mar 27 13:34:46 2012 +0200 Fix bug #61504, potential vuln. in fileinfo. update to 5.11 Is this not affected to 5.3? Just curious. -- Yasuo Ohgaki yohgaki@ohgaki.net On Wed, Mar 5, 2014 at 6:52 PM, JulienPauli <jpauli@php.net> wrote: > Commit: 61bcea70199b94d057ff60fb666a279376c8af2d > Author: Anatol Belski <ab@php.net> Thu, 20 Feb 2014 18:53:53 > +0100 > Committer: Julien Pauli <jpauli@php.net> Wed, 5 Mar 2014 10:52:05 > +0100 > Parents: 46996a68a3996777bac94cc4af4935e024804267 > Branches: PHP-5.5.10 > > Link: > > http://git.php.net/?p=php-src.git;a=commitdiff;h=61bcea70199b94d057ff60fb666a279376c8af2d > > Log: > fixed leak introduced after CVE/upgrade > > Changed paths: > M ext/fileinfo/libmagic/softmagic.c > > > Diff: > diff --git a/ext/fileinfo/libmagic/softmagic.c > b/ext/fileinfo/libmagic/softmagic.c > index 7c5f628..33970e5 100644 > --- a/ext/fileinfo/libmagic/softmagic.c > +++ b/ext/fileinfo/libmagic/softmagic.c > @@ -1701,6 +1701,8 @@ mget(struct magic_set *ms, const unsigned char *s, > struct magic *m, > return -1; > if (file_printf(ms, "%s", rbuf) == -1) > return -1; > + } > + if (rbuf) { > efree(rbuf); > } > return rv; > > > -- > PHP CVS Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > >